diff options
Diffstat (limited to 'opt/caddy/MAKEPKG')
| -rw-r--r-- | opt/caddy/MAKEPKG | 151 |
1 files changed, 151 insertions, 0 deletions
diff --git a/opt/caddy/MAKEPKG b/opt/caddy/MAKEPKG new file mode 100644 index 0000000..341b97c --- /dev/null +++ b/opt/caddy/MAKEPKG @@ -0,0 +1,151 @@ +#!/bin/mkpkg +# description: Fast, extensible web server with automatic HTTPS +# url: https://caddyserver.com/ + +name=caddy +version=2.11.4 +release=2 +makedeps=(go) +groups=(caddy:user:caddy:/var/lib/caddy:750) +services=(caddy) +capabilities=( + /usr/bin/caddy:cap_net_bind_service+ep +) +permissions=( + /etc/caddy:root:caddy:750 + /etc/caddy/Caddyfile:root:caddy:640 + /var/lib/caddy:caddy:caddy:750 + /var/lib/caddy/www:caddy:caddy:750 +) + +source=(https://github.com/caddyserver/$name/archive/refs/tags/v$version.tar.gz) +renames=($name-$version.tar.gz) +sha256sums=( + "2c3d02078286a6282cdb4d1d8744077788d556659dac0b64d8ed5886a7e5aeb9" +) + +build() { + cd $name-$version + export GOFLAGS="-trimpath -mod=readonly -v" + export GOTOOLCHAIN=local # do not fetch a toolchain from the module proxy + + # caddy.Version() reads module info from debug.ReadBuildInfo(). A tarball + # build has no VCS metadata, so the version falls back to CustomVersion. + go build \ + -ldflags "-s -w -X github.com/caddyserver/caddy/v2.CustomVersion=v$version" \ + -o bin/caddy \ + ./cmd/caddy + + install -Dm755 bin/caddy $PKG/usr/bin/caddy + + # man pages, generated by the freshly built binary (section 8) + ./bin/caddy manpage --directory docs/man + mandir="$PKG/usr/share/man" + for f in docs/man/caddy*.8; do + install -Dm644 "$f" "$mandir/man8/$(basename $f)" + done + + # Config directory + install -d -m 750 $PKG/etc/caddy + + printf '%s\n' \ + '# rawnix Caddy configuration' \ + '# See https://caddyserver.com/docs/caddyfile' \ + '' \ + '{' \ + ' # Admin API, loopback only' \ + ' admin localhost:2019' \ + '' \ + ' # ACME account address for automatic HTTPS' \ + ' # email admin@example.org' \ + '}' \ + '' \ + '# The default site listens on an unprivileged port because the service' \ + '# runs as the caddy user. To serve a real domain with automatic HTTPS' \ + '# on :80/:443 see the note in /etc/sv/caddy/run.' \ + '#' \ + '# example.org {' \ + '# root * /var/lib/caddy/www' \ + '# file_server' \ + '# encode zstd gzip' \ + '# }' \ + '' \ + ':8080 {' \ + ' root * /var/lib/caddy/www' \ + ' file_server' \ + ' encode zstd gzip' \ + '' \ + ' header {' \ + ' X-Content-Type-Options nosniff' \ + ' X-Frame-Options DENY' \ + ' Referrer-Policy strict-origin-when-cross-origin' \ + ' -Server' \ + ' }' \ + '' \ + ' log {' \ + ' output stderr' \ + ' format console' \ + ' }' \ + '}' \ + > $PKG/etc/caddy/Caddyfile + + # State directory: certificates, OCSP staples, autosave.json, docroot + install -d -m 750 $PKG/var/lib/caddy + install -d -m 750 $PKG/var/lib/caddy/www +} + +post_build() { + # runit service + install -d $PKG/etc/sv/caddy/log + + printf '%s\n' \ + '#!/bin/sh' \ + 'exec 2>&1' \ + '' \ + '# Certificates, OCSP staples and autosave.json live under /var/lib/caddy' \ + '# so that /etc/caddy stays read-only for the service user.' \ + 'export HOME=/var/lib/caddy' \ + 'export XDG_DATA_HOME=/var/lib/caddy' \ + 'export XDG_CONFIG_HOME=/var/lib/caddy' \ + '' \ + '# Prepare runtime directories (/var/lib/caddy ownership comes from' \ + '# the package permissions= directive)' \ + 'install -d -m 750 -o caddy -g caddy /run/caddy' \ + '' \ + '# Validate as the user that will run the server: provisioning the tls' \ + '# app can populate XDG_DATA_HOME, and root-owned files there would be' \ + '# unusable at renewal time.' \ + 'chpst -u caddy:caddy caddy validate --adapter caddyfile --config /etc/caddy/Caddyfile || exit 1' \ + '' \ + '# Binding :80/:443 as the caddy user needs one of:' \ + '# setcap cap_net_bind_service=+ep /usr/bin/caddy' \ + '# sysctl net.ipv4.ip_unprivileged_port_start=80' \ + '# Otherwise drop the chpst prefix below and run caddy as root.' \ + 'exec chpst -u caddy:caddy caddy run --adapter caddyfile --config /etc/caddy/Caddyfile' \ + > $PKG/etc/sv/caddy/run + + printf '%s\n' \ + '#!/bin/sh' \ + 'mkdir -p /var/log/caddy' \ + 'exec svlogd -tt /var/log/caddy' \ + > $PKG/etc/sv/caddy/log/run + + printf '%s\n' \ + '#!/bin/sh' \ + 'rm -rf /run/caddy' \ + > $PKG/etc/sv/caddy/finish + + chmod 755 $PKG/etc/sv/caddy/run + chmod 755 $PKG/etc/sv/caddy/log/run + chmod 755 $PKG/etc/sv/caddy/finish + + # Service disabled by default - edit the Caddyfile, then: rm /etc/sv/caddy/down + touch $PKG/etc/sv/caddy/down +} + +signify() { + untrusted comment: public key + RWTZ9IduCSQ/mL8337TEUinPwT92xFEUpD92hkS7IxcOnzTt9QdpohT3 +} + +# vim: filetype=sh |